MFA's Weakest Link: Account Recovery Is the New Attack Path
Help desk account recovery is increasingly the weakest link in MFA-protected identities, as Scattered Spider's impersonation-driven Marks & Spencer attack demonstrated.
As MFA, conditional access, and phishing-resistant factors raise the cost of direct account takeover, attackers increasingly target the recovery process, convincing service desk staff to reset passwords or re-register MFA on attacker-controlled devices. CISA, FBI, and partner advisories describe Scattered Spider posing as employees to trigger such resets; the 2025 Marks & Spencer attack began this way and led to ransomware with an estimated £300 million profit impact. Microsoft now describes Entra ID account recovery as a high-assurance process, and the article promotes Specops Secure Service Desk for verified identity workflows.
- Attackers call service desks posing as employees to reset passwords and transfer MFA
- Scattered Spider impersonated an employee to trigger the M&S breach
- Recovery verification should match the assurance of primary authentication
- Specops Secure Service Desk integrates with Duo, Okta, PingID, and Symantec VIP
- Tags
- account-recoveryhelp-deskidentity-securitymarks-and-spencermfascattered-spidersocial-engineeringvishing
- Threat actors
- Scattered Spider
- Victims
- Marks & Spencer
- Countries
- United Kingdom
From the original article
4 min read at bleepingcomputer.com
MFA makes account takeover harder, but attackers are increasingly targeting the recovery processes used to reset passwords and authentication methods. Specops explains why stronger identity verification at the service desk is critical to preventing social engineering attacks from turning account recovery into account takeover. [...]
By Sponsored by Specops Software · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.